AL-JANEF
UserDefensive security & production-grade engineering skills for Claude Code — auth, OWASP audit, threat modeling, secrets, logging.
Categories
Indexed Skills (7)
auth-hardening
Review, harden, and design authentication and session management for web applications — login, logout, session lifecycle, password storage, token handling, and brute-force protection. Use this skill whenever the user is building or reviewing sign-in / sign-out flows, JWT or session cookies, password hashing, "remember me", refresh tokens, account lockout, OTP/MFA, or password reset — even if they only mention "login" or "auth" casually. Applies to Node.js, Next.js, and similar stacks. Defensive only: this skill hardens auth systems, it does not bypass or attack them.
engineering-standard
Enforce a strict, production-grade engineering standard on any serious coding task — writing, reviewing, refactoring, debugging, or completing a feature. Applies correctness, security, performance, and maintainability discipline; bans placeholder/dead code and silent failures; requires evidence for every claim of success; and gates completion on lint, typecheck, tests, and build. Use this skill whenever the user is building or reviewing real application code, fixing a bug, or asking whether code is production-ready — especially in TypeScript/Node/Next.js and multi-tenant systems. It raises quality and rigor; it does not attack systems or bypass controls.
secrets-guard
Prevent secrets from leaking into code, git history, logs, or client bundles — API keys, database credentials, tokens, private keys, and connection strings. Detects hardcoded secrets, guides correct secret management (env vars, secret managers), and sets up prevention (gitignore, pre-commit scanning). Use this skill whenever the user is handling API keys or credentials, setting up environment variables, connecting to external services, committing config, or asks about keeping secrets safe — even a casual "where do I put my API key?". Defensive only.
security-logging
Design and review security audit logging and monitoring — recording who did what and when, detecting suspicious activity (repeated failed logins, unusual access), and doing it without leaking sensitive data into the logs themselves. Use this skill whenever the user is building audit trails, adding logging to sensitive actions, setting up monitoring or alerting, investigating an incident, or asks "how do I track who did X?" — especially for auth events, data changes, and admin actions. Defensive only.
threat-model
Run a structured threat-modeling pass at the design stage — before code — to find security risks in an architecture or feature. Uses STRIDE (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege) to systematically ask "how could this be attacked?". Use this skill whenever the user is designing a system, planning a new feature, drawing an architecture, defining APIs, or asks "what could go wrong security-wise?" — especially before implementation begins. Defensive only: it identifies risks and mitigations, it does not plan attacks.
vuln-audit
Audit web application code for common vulnerabilities — the OWASP Top 10 class of bugs: injection (SQL/NoSQL/command), XSS, CSRF, SSRF, IDOR / broken access control, insecure deserialization, unsafe file upload, and security misconfiguration. Use this skill whenever the user asks to review code for security, find vulnerabilities, do a security pass before shipping, or is writing code that handles user input, database queries, file uploads, or external requests — even if they only say "review this" or "is this safe?". Defensive only: this skill finds and fixes weaknesses, it does not write exploits.
janef
Entry point to the janefskills security & engineering suite. Invoke with /janef to route a security or code-quality task to the right specialist skill — auth-hardening, vuln-audit, threat-model, secrets-guard, security-logging, or engineering-standard — or to run a full multi-skill security pass. Use when you want the janefskills suite but don't want to remember which specific skill applies. Defensive only.
Bio shown is the top-scored skill's repo description as a fallback — real GitHub bios land in a future update.